System, method, and program product for managing an intrusion detection system

Abstract

An intrusion event detection system, method, and program product with an enumeration of specific known benign intrusion events, and performing a vulnerability test on specific elements of the computer system for the particular known benign intrusion event. These vulnerability tests are performed at predetermined time intervals measured from a previous test or previous intrusion event of the known benign intrusion event. The predetermined time interval is increased based on various attributes, passage of time since the last intrusion event of either the specific known benign intrusion event or another known benign intrusion event, or even a an undetermined or harmful intrusion event, or the present detection of an intrusion even; or the vulnerability of a specific element in the computer system to a specific intrusion event.

Description

FIELD OF THE INVENTION [0001] The invention described herein relates to the protection of computer systems, including computer system hardware, software, and data from generally malicious intrusion, attack, destruction, unauthorized modification, and unauthorized disclosure. More particularly, the invention relates to recording intrusion attempts based upon harm to the system and immunity of the system to the particular attack. BACKGROUND [0002] Network attack traffic is a serious problem for all information technology users. The goals of network attack are many and varied, to crash a particular machine or particular server, to acquire network information, to misuse data, or to take control of a particular machine. One line of defense is the intrusion detection system. [0003] Intrusion detection systems include host-based systems, network-based systems, and node-based systems. A host-based system generally monitors user activity on the system by examining alert messages, log files, ...

Images